VULNERABILITY INTELLIGENCE

CVE-2021-41290

CVSS score9.8 CRITICAL
EPSS probability2.32%
CISA KEVNot currently listed
Published2021-09-30
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device.

Weakness classification

  • twcert@cert.org.tw: CWE-434
  • nvd@nist.gov: CWE-22

Primary references